Blind Detection of Steganographic Content in Digital Images Using Cellular Automata

Transcription

1 80 Blind Detection of Steganographic Content in Digital Images Using Cellular Automata Sasan Hamidi 80.1 Introduction Motivation for Research Background on Cellular Automata Background on Digital Images and Steganography Methodology Test Results Conclusion References Introduction Steganography is the art of hiding messages or other forms of data and information within another medium. The goal of steganography is to hide the information so it can escape detection. On the other hand, steganalysis attempts to uncover such hidden messages through a variety of techniques. Many freeware and commercially available steganographic tools are currently available for hiding information in digital images (Johnson et al., 2001). Corresponding to these tools are methods devised specifically for each algorithm to detect the hidden contents. Almost all current steganalysis tools today require prior knowledge of the algorithm that was used during the steganography process; in other words, some statistical test must be performed to determine the signature associated with a particular steganographic tool or technique. Hence, by introducing new complexities and techniques, current steganalysis techniques become obsolete. The method proposed in this chapter represents a digital image in a cellular automata-based, two-dimensional array. Each cell within this two-dimensional plane is examined for anomalies presented by the process of steganography. The author believes that the technique used here is statistically more robust than other techniques presented thus far and is capable of handling complex and chaotic steganographic algorithms. 1039

2 1040 Information Security Management Handbook 80.2 Motivation for Research Current steganographic detection methods have several deficiencies: The detection method has to match the algorithm used in the steganography process. Tests must be performed to match the signature toaspecific technique used to embed the data within the medium. Slight variations in steganographic methods can render the current techniques useless. Almost all steganalysis techniques suffer from a high rate of false positives (Berg et al., 2003). To the best of the author s knowledge, to date no techniques utilize cellular automata (CA) for the detection of steganographic content in any medium. Additionally, only two methods today propose techniques to improve on the deficiencies mentioned above.the methods proposed by Berg et al. (2003) and Lyu and Farid (2002) utilize machine learning as their underlying concept. Artificial neural networks (ANNs) are a particular method for empirical learning. ANNs have proven to be equal, or superior,to other empirical learning systems over awide range of domains when evaluated in terms of their generalization ability (Cox et al., 1996; Schatten, 2005); however, although these methods have significantly improved on the areas mentioned earlier, they suffer from the following problems (Ahmad, 1988; Atlas et al., 1989; Shavlik et al., 1991; Towell and Shavlik, 1992): Training times are lengthy. The initial parameters of the network can greatly affect how well concepts are learned. No problem-independent way to choose a good network topology exists yet, although considerable research has been aimed in this direction. After training, neural networks are often very difficult to interpret. The proposed method has the advantage of being able to be applied to both index- and compressionbased images. Examples of index-based images are GIF and BMP file types, and compression-based examples are MPEG and JPEG Background on Cellular Automata The basic element of acaisthe cell. Acellisakind of amemoryelement that is capable of retaining its state. In the simplest case, each cell can have the binary states 1 or 0. In more complex simulation, the cells can have more different states. These cells are arranged in a spatial web,called a lattice.the simplest one is the one-dimensional lattice, where all cells are arranged in a line like a string. The most common CA is built in one or two dimensions. For the cells to grow, or transition from their static state to a von Neuman neighborhood Moore neighborhood Extended moore neighborhood EXHIBIT 80.1 Three different neighborhoods.

3 Blind Detection of Steganographic Content in Digital Images Using Cellular Automata 1041 dynamic one, rules must be applied. Each rule defines the state of the next step in forming new cells. Additionally, in a cellular automata lattice, the state of the next cell depends on its neighbor. Thus, the concept of neighborhood is an important one. Exhibit 80.1 shows three different neighborhoods. The distinguishing characteristic is the rules that are applied to each cell to form the lattice (Schatten, 2005) Background on Digital Images and Steganography To acomputer,an image is an array of numbers that represent light intensities at various points (pixels). These pixels make upthe raster data of the image. Acommon image size is 640! 480 pixels and 256 colors (or 8bits per pixel). Such an image could contain about 300 kilobits of data. Digital images are typically stored in either 24-bit or 8-bit files. A 24-bit image provides the most space for hiding information; however, it can be quite large (with the exception of JPEG images). All color variations for the pixels are derived from three primarycolors: red, green, and blue. Each primarycolor is represented by 1byte; 24-bit images use 3bytes per pixel to represent acolor value. These 3bytes can be represented as hexadecimal, decimal, and binary values. In many Web pages, the background color is represented by a six-digit hexadecimal number actually three pairs representing red, green, and blue. A white background would have the value FFFFFF: 100 percent red (FF), 100 percent green (FF), and 100 percent blue (FF). Its decimal value is 255, 255, 255, and its binaryvalue is , , , which are the 3 bytes making up white. Most steganography software neither supports nor recommends using JPEG images but recommends instead the use of lossless 24-bit images such as BMP. The next-best alternative to 24-bit images is 256- color or grayscale images. The most common of these found on the Internet are GIF files (Cox et al. 1996). In 8-bit color images such as GIF files, each pixel is represented as asingle byte, and each pixel merely points to acolor index table (a palette) with 256 possible colors. The value of the pixel, then, is between 0 and 255. The software simply paints the indicated color on the screen at the selected pixel position. Exhibit 80.2a, a red palette, illustrates subtle changes in color variations: visually differentiating between many of these colors is difficult. Exhibit 80.2b shows subtle color changes as well as those that seem drastic. Manysteganographyexperts recommend using images featuring 256 shades of gray (Aura, 1995). Grayscale images are preferred because the shades change very gradually from byte to byte, and the less the value changes between palette entries, the better they can hide information. EXHIBIT 80.2 Color palettes: (a) red palette; (b) color palette.

4 1042 Information Security Management Handbook Least significant bit (LSB) encoding is by far the most popular of the coding techniques used for digital images. By using the LSB of each byte (8 bits) in an image for asecret message, it is possible to store3bits of data in each pixel for 24-bit images and 1bit in each pixel for 8-bit images. Obviously, much more information can be stored in a 24-bit image file. Depending on the color palette used for the cover image (e.g., all gray), it is possible to take 2LSBs from one byte without the human visual system (HVS) being able to tell the difference. The only problem with this technique is that it is very vulnerable to attack such as image changes and formatting (e.g., changing from a GIF format to JPEG) Methodology The entire premise of the proposed method is that by introducing steganographic content the intensity of each pixel will change, and the condition of the neighboring cells can be determined by devising CA rules. Regardless of the steganographic technique, this phenomenon occurs in every instance. The detection of this change in intensity could help in the detection process. The image in this case is represented as a plane, with each pixel conceptualized as a cell in a cellular automation lattice. This method uses a technique similar to that of Adriana Popovici and Dan Popovici (Wolfram, 2002) to enhance the quality of digital images. Each cell representing each pixel in the target image is identified by its position within the plane (i, j); however, unlike the Popovici proposal, the next identifying value will be the cell s binary value of its corresponding color. Thus, each cell will have a binary value that consists of its position and the color its represents. In this proposal, each cell points to a color index table (a palette) with 256 possible colors and values between 0 and 255. As mentioned earlier, most steganographic techniques do not use JPEG images as their preferred medium because these image types are easily distorted and detection is therefore much simpler. Instead, other image types, such as BMP and GIF are used. For example, cell Acould be represented as A(0001, 0010, 1111), which means that cell A is in the first rowofthe second columnpointing to the palette of color white in an N! N plane. The proposal calls for testing all of Wolfram s 256 rules (0 to 255) to devise aset of rules to explain anormal condition for an unaltered image (Wolfram, 2002). In the plane, anormal picture (one that has not been embedded with any data) would exhibit a certain behavior (transition of cells and the neighborhood rule). The method proposes asample test of 100 pictures to determine the general CA rule that can be deduced for each image type. A similar test of 100 images that contain steganographic content is performed to come up with a similar rule for these images. Because compression and index-type images use different techniques for image creation, multiple CA rules must be developed to detect the presence of hidden data within each file type Test Results Using the Jsteg Shell steganographic tool and OutGuess, commonly used tools to embed information in JPEG files, ten pictures (from a family album) were embedded with plaintext. The original images (before steganography) and embedded ones were subjected to Wolfram s 256 rules. Initial tests have shown that rules 4and 123 exhibit similar behavior when processing the original pictures. In other words, the single most common kind of behavior exhibited by the experiment was one in which a pattern consisting of a single cell or asmall group of cells persisted. In other cases, however,such as rules 2and 103, it movedto the left or right. When processing the embedded images using the same method, an emerging common pattern could not initially be deduced. The significant finding is that, at the very least, there are observable distinguishable patterns between an original picture and one that has been embedded using Jsteg and OutGuess. Exhibit 80.3a shows the original picture in JPEG format. Exhibit 80.3b shows the same picture embedded with a Word file 24 KB in size. A distinguishable distortion in size and image quality can be observed in Exhibit 80.3b. As stated earlier, JPEG is not favorite medium of steganographic tools

5 Blind Detection of Steganographic Content in Digital Images Using Cellular Automata 1043 EXHIBIT 80.3 (a) Original versus (b) carrier picture. and algorithms; however, this file type was chosen for this initial experiment to ensure that all distortions were captured when converting the images into CA rules. Future tests must be performed on all other image types to determine their distinguishable patterns (if any) through cellular automata representation. Refinements of CA rules are also necessary in order to produce better patterns for both original and carrier images. (Carrier images are those that contain steganographic content.) 80.7 Conclusion Steganography has developed from its humble beginnings as the secret little hobby of a few bored security gurus to ahot topic of discussion at many technologyconferences. In the past threeyears, the SANS and RSA conferences, two of the most important security conferences in the United States, have featured tracts on the area of information hiding and steganography. The war on terrorism seems to have had a profound effect on the growth of steganography. It has been argued that the terrorists involved with the September 11 tragedy communicated through many convert channels, mainly through the use of steganography. A great deal of research must be performed to determine the applicability of cellular automata to the detection of steganographic content in digital images. The results of this research must be compared with many steganalysis applications and algorithms along with other proposed detection methods (Berg et al. 2003; Lyu and Farid, 2002) to determine its efficiency. Proposed improvements could be the development of a hybrid system where the capability of cellular automata could be paired with machine learning techniques to develop a robust and adaptive detection method. Automated learning and data-mining techniques are other avenues that could be pursued. There is little doubt that development in the area of covert communications and steganography will continue. Research in building morerobust methods that can survive image manipulation and attacks is ongoing. Steganalysis techniques will be useful to law enforcement authorities working in computer forensics and digital traffic analysis. The idea of asteganalysis algorithm that can learn the behavior exhibited by carrier mediums is tremendously appealing.

6 1044 Information Security Management Handbook References Ahmad, S A Study of Scaling and Generalization in Neural Networks, Tech. Rep. CCSR-88-13, University of Illinois, Center for Complex Systems Research, Urbana. Atlas, L., Cole, R., Connor, J., and El-Sharkawi, M Performance comparisons between backpropagation networks and classification trees on three real-world applications. Adv. Neural Inform. Proc.Syst., 2, Aura, T., Invisible Communication. In Proc. of EET 1995, Tech. Rep., Helsinki University of Technology, Helsinki, Finland. ( Berg,G., Davidson, I., Duan, M., and Paul. G Searching for hidden messages: automatic detection of steganography. In Proc. of the 15th AAAI Innovative Applications of Artificial Intelligence Conference, Acapulco, Mexico, August , Cox, I. et al A secure, robust watermark for multimedia. In Proc. of the First International Workshop on Information Hiding, Lecture Notes in Computer Science No. 1, pp Springer-Verlag, Berlin. Fahlman, S. E. and Lebiere, C The cascade-correlation learning architecture. Adv. Neural Inform. Process. Syst., 2, Johnson, N. F., Duric, Z., and Jajodia, S Information Hiding: Steganography and Watermarking Attacks and Countermeasures. Kluwer Academic, Dordrecht. Kurak, C. and McHugh. J A cautionary note on image downgrading. In Proc. of the IEEE Eighth Ann. Computer Security Applications Conference, pp IEEE Press, Piscataway, NJ. Lyu, S. and Farid. H Detecting hidden messages using higher-order statistics and support vector machines. In Proc. of the Fifth International Workshop on Information Hiding, Noordwijkerhout, Netherlands, Springer-Verlag, New York. Preston, K. and Duff, M. eds Modern Cellular Automata: Theory and Applications. Plenum Press, New York. Schatten, A Cellular Automata: Digital Worlds, Shavlik, J. W., Mooney, R. J., and Towell, G. G Symbolic and neural net learning algorithms: an empirical comparison. Machine Learning, 6, Towell, G. G. and Shavlik, J. W Extracting refined rules for knowledge-based neural networks. Machine Learning, 8, Wolfram, S A New Kind of Science, pp , Wolfram Media, Champaign, IL.